Granted Patent B2

US 12,731,147 · App. 17/707,658 · Granted Sep 8, 2026

Inventors: Devon David Jorlett (Crystal, MN); Adrienne Vickery (Toronto, CA); Matthew Walter Misler (Mississauga, CA)

Assignee: The Toronto-Dominion Bank

G06Q20/4016G06F18/217G06N20/00

Abstract

Claims (68)

1 . A computer server apparatus for re-ordering or re-prioritizing a position of a potentially fraudulent transaction or interaction within a fraud detection alert queue using a trained machine learning or artificial-intelligence process, comprising:

a memory storing instructions;

an electronic communications interface; and

at least one processor coupled to the memory and the electronic communications interface, the at least one processor being configured to execute the instructions to:

obtain, from the alert queue, a data element associated with a requested digital interaction between the computer server apparatus and a computing device of a customer across a corresponding electronic communications network, the data element comprising a party identifier associated with the customer and a plurality of values of parameters associated with the requested digital interaction, the parameter values comprising a geographic location of the computing device and a temporal identifier associated with the interaction, the alert queue comprising data elements corresponding to potentially fraudulent transactions, and the data element being disposed within the alert queue at a position indicating a first likelihood that the requested digital interaction represents an instance of actual fraudulent activity;

obtain, from the memory, process input data that specifies a structure and composition of an input dataset associated with the trained machine-learning or artificial-intelligence process, the process input data identifying discrete input feature values and a specified sequence of the discrete input feature values within the input dataset;

obtain previous interaction data for the customer from the memory based on the party identifier, and generate the input dataset based on elements of the previous interaction data for the customer and in accordance with the process input data by (i) extracting a first feature value of the discrete input feature values from the previous interaction data or (ii) computing a second feature value of the discrete input feature values based on the first feature value, and by packaging the extracted or computed feature values at the specified sequence defined by the process input data, wherein the feature values comprise a targeted set of transaction or interaction parameters during a previous temporal interval, the targeted set including a temporal identifier corresponding to the previous temporal interval;

apply the trained machine-learning or artificial-intelligence process to the input dataset in accordance with one or more parameters that characterize the trained machine-learning or artificial-intelligence process, wherein the trained machine-learning or artificial-intelligence process is trained to predict, for the customer, customer-specific values of parameters that characterize a behavior of the customer during a future temporal interval and a range of expected deviations from each of these customer-specific values during the future temporal interval, and wherein the customer-specific values comprise at least time-averaged values associated with previous interactions of the customer;

based on the application of the trained machine-learning or artificial-intelligence process to the input dataset, generate behavioral profile data that includes an expected geographic location of the computing device during the future temporal interval and a range of expected deviations from the expected geographic location of the computing device during the future temporal interval;

based on a determination that the expected geographic location and the range of expected deviations fail to include the geographic location of the computing device at the time of the requested digital interaction, perform operations that modify the position of the data element within the alert queue, the modified position indicating a second likelihood that the requested digital interaction represents the instance of actual fraudulent activity, and the second likelihood exceeding the first likelihood; and

transmit, in real-time, to an additional computing device via the communications interface, a notification that includes the data element and information characterizing the modified position of the data element within the alert queue, the additional computing device performing operations that confirm the requested digital interaction represents the instance of actual fraudulent activity based on the data element and the information.

2 . The apparatus of claim 1 , wherein the at least one processor is further configured to execute the instructions to:

store the behavioral profile data and the party identifier within a portion of the memory;

receive, via the electronic communications interface, information characterizing an additional exchange of data, the information comprising the party identifier and a second value of the parameter;

obtain the behavioral profile data from the memory based on the party identifier; and

based on a determination that the range of expected deviations fails to include the second parameter value, determine that the additional data exchange represents an instance of potentially fraudulent activity, and generate an additional data element associated with the additional data exchange, the additional data element being maintained at a corresponding position within the alert queue.

3 . The apparatus of claim 1 , wherein the at least one processor is further configured to execute the instructions to:

obtain elements of second interaction data, each of the elements of the second interaction data comprising a temporal identifier associated with a temporal interval;

based on the temporal identifiers, determine that a first subset of the elements of the second interaction data are associated with a prior training interval, and that a second subset of the elements of the second interaction data are associated with a prior validation interval; and

generate a plurality of training datasets based on corresponding portions of the first subset, and perform operations that train the trained machine-learning or artificial-intelligence process based on the training datasets.

4 . The apparatus of claim 3 , wherein the at least one processor is further configured to execute the instructions to:

generate a plurality of validation datasets based on corresponding portions of the second subset;

apply the trained machine-learning or artificial-intelligence process to the plurality of validation datasets, and generate additional elements of output data based on the application of the trained machine-learning or artificial-intelligence process to the plurality of validation datasets;

compute one or more validation metrics based on the additional elements of output data; and

based on a determined consistency between the one or more validation metrics and a threshold condition, validate the trained machine learning or artificial intelligence process.

5 . The apparatus of claim 1 , wherein:

the requested digital interaction is associated with an access product, and at least one of the parameter values comprises a value of an interaction parameter associated with the requested digital interaction;

the behavioral profile data comprises an expected value of the interaction parameter during the temporal interval and ranges of expected deviations from the expected value during the temporal interval;

the at least one processor is further configured to execute the instructions to perform the operations that prioritize the position of the data element within the alert queue based on a determination that the range of expected deviations fails to include the interaction parameter value.

6 . The apparatus of claim 1 , wherein the additional computing device is configured to obtain at least the data element and the information characterizing the modified position of the data element within the alert queue, and present, within a digital interface, a graphical representation of the data element at the modified position within the alert queue.

7 . The apparatus of claim 1 , wherein:

the computing device is configured to execute an application program, the executed application program generating at least a portion of the data element; and

the requested digital interaction comprises at least one of a request to obtain the application program associated with the computer server apparatus and executable by the computing device, a request to access a digital platform established by the at least one processor of the computer server apparatus, a request to access data across the electronic communications network via the application program, or a request to modify an authentication credential associated with the computing device.

8 . The apparatus of claim 1 , wherein:

the trained machine-learning or artificial-intelligence process comprises a trained gradient-boosted decision tree process; and

the at least one processor is further configured to execute the instructions to:

establish a plurality of decision trees for the trained, gradient-boosted decision tree process based on one or more additional parameters that characterize the trained gradient-boosted decision tree process, and provision a corresponding element of the input dataset to an input node of each of the established decision trees; and

based on the provisioning of the elements of the input dataset to the input nodes of the established decision trees, perform operations that apply the application of a trained gradient-boosted decision tree artificial intelligence process to the input dataset and generate the behavioral profile data.

9 . A computer-implemented method for re-ordering or re-prioritizing a position of a potentially fraudulent transaction or interaction within a fraud detection alert queue using a trained machine learning or artificial-intelligence process, comprising:

obtaining, using at least one processor of a computer server, and from the alert queue, a data element associated with a requested digital interaction between the computer server and a computing device of a customer across a corresponding electronic communications network, the data element comprising party identifier associated with the customer and a plurality of values of parameters associated with the requested digital interaction, the first parameter values comprising a geographic location of the computing device and a temporal identifier associated with the interaction, the alert queue comprising data elements corresponding to potentially fraudulent transactions, and the data element being disposed within the alert queue at a position indicating a first likelihood that the requested digital interaction represents an instance of actual fraudulent activity;

using the at least one processor, obtaining process input data that specifies a structure and composition values of an input dataset associated with the trained machine-learning or artificial-intelligence process, the process input data identifying discrete input feature values and a specified sequence of the discrete input feature values within the input dataset;

using the at least one processor, obtaining previous interaction data for the customer from a data repository based on the party identifier, and generating the input dataset based on elements of the previous interaction data for the customer and in accordance with the process input data by (i) extracting a first feature value of the discrete input feature values from the previous interaction data or (ii) computing a second feature value of the discrete input feature values based on the first feature value, and by packaging the extracted or computed feature values at the specified sequence defined by the process input data, wherein the feature values comprise a targeted set of transaction or interaction parameters during a previous temporal interval, the targeted set including a temporal identifier corresponding to the previous temporal interval;

using the at least one processor, applying the trained machine-learning or artificial-intelligence to the input dataset in accordance with one or more parameters that characterize the trained machine-learning or artificial-intelligence process, wherein the trained machine-learning or artificial-intelligence process is trained to predict, for the customer, customer-specific values of parameters that characterize a behavior of the customer during a future temporal interval and a range of expected deviations from each of these customer-specific values during the future temporal interval, wherein the customer-specific values comprise at least time-averaged values associated with previous interactions of the customer;

based on an application of the trained machine-learning or artificial-intelligence process to the input dataset, generating behavioral profile data that includes an expected geographic location of the computing device during the future temporal interval and a range of expected deviations from the expected geographic location of the computing device during the future temporal interval;

based on a determination that the expected geographic location and the range of expected deviations fails to include the geographic location of the computing device at the time of the requested digital interaction, performing operations, using the at least one processor, that modify the position of the data element within the alert queue, the modified position indicating a second likelihood that the requested digital interaction represents the instance of actual fraudulent activity, and the second likelihood exceeding the first likelihood; and

using the at least one processor, transmitting, in real-time, to an additional computing device, a notification that includes the data element and information characterizing the modified position of the data element within the alert queue, the additional computing device performing operations that confirm the requested digital interaction represents the instance of actual fraudulent activity based on the data element and the information.

10 . The computer-implemented method of claim 9 , further comprising:

using the at least one processor, store the behavioral profile data and the party identifier within a portion of a data repository;

receiving, using the at least one processor, information characterizing an additional exchange of data, the information comprising the party identifier and a second value of the parameter;

using the at least one processor, obtaining the behavioral profile data from the data repository based on the party identifier; and

based on a determination that the range of expected deviations fails to include the second parameter value, determining, using the at least one processor, that the additional data exchange represents an instance of potentially fraudulent activity, and generate an additional data element associated with the additional data exchange using the at least one processor, the additional data element being maintained at a corresponding position within the alert queue.

11 . The computer-implemented method of claim 9 , further comprising:

obtain elements of second interaction data using the at least one processor, each of the elements of the second interaction data comprising a temporal identifier associated with a temporal interval;

based on the temporal identifiers, determining, using the at least one processor, that a first subset of the elements of the second interaction data are associated with a prior training interval, and that a second subset of the elements of the second interaction data are associated with a prior validation interval; and

using the at least one processor, generating a plurality of training datasets based on corresponding portions of the first subset, and performing operations that train the trained machine-learning or artificial-intelligence process based on the training datasets.

12 . The computer-implemented method of claim 11 , further comprising:

generating, using the at least one processor, a plurality of validation datasets based on corresponding portions of the second subset;

using the at least one processor, applying the trained machine-learning or artificial-intelligence process to the plurality of validation datasets, and generating additional elements of output data based on the application of the trained machine-learning or artificial-intelligence process to the plurality of validation datasets;

computing, using the at least one processor, one or more validation metrics based on the additional elements of output data; and

based on a determined consistency between the one or more validation metrics and a threshold condition, validating the trained machine-learning or artificial-intelligence process using the at least one processor,.

13 . A tangible, non-transitory computer-readable medium storing instructions that, when executed by at least one processor of a computer server, cause the at least one processor to perform a method for re-ordering or re-prioritizing a position of a potentially fraudulent transaction or interaction within a fraud detection alert queue using a trained machine learning or artificial-intelligence process, comprising:

obtaining, from the alert queue, a data element associated with a requested digital interaction between the computer server and a computing device of a customer across a corresponding electronic communications network, the data element comprising party identifier associated with the customer and a plurality of values of parameters associated with the requested digital interaction, the first parameter values comprising a geographic location of the computing device and a temporal identifier associated with the interaction, the alert queue comprising data elements corresponding to potentially fraudulent transactions, and the data element being disposed within the alert queue at a position indicating a first likelihood that the requested digital interaction represents an instance of actual fraudulent activity;

obtaining process input data that specifies a structure and composition of an input dataset associated with the trained machine-learning or artificial-intelligence process, the process input data identifying discrete input feature values and a specified sequence of the discrete input feature values within the input dataset;

obtaining previous interaction data for the customer from a data repository based on the party identifier, and generating the input dataset based on elements of the previous interaction data for the customer and in accordance with the process input data by (i) extracting a first feature value of the discrete input feature values from the previous interaction data or (ii) computing a second feature value of the discrete input feature values based on the first feature value, and packaging the extracted or computed feature values at the specified sequence defined by the process input data, wherein the feature values comprise a targeted set of transaction or interaction parameters during a previous temporal interval, the targeted set including a temporal identifier corresponding to the previous temporal interval;

applying the trained machine-learning or artificial-intelligence process to the input dataset in accordance with one or more parameters that characterize the trained machine-learning or artificial-intelligence process, wherein the trained machine-learning or artificial-intelligence process is trained to predict, for the customer, customer-specific values of parameters that characterize a behavior of the customer during a future temporal interval and a range of expected deviations from each of these customer-specific values during the future temporal interval, wherein the customer-specific values comprise at least time-averaged values associated with previous interactions of the customer;

based on the application of the trained machine-learning or artificial-intelligence process to the input dataset, generating behavioral profile data that includes an expected geographic location of the computing device during the future temporal interval and a range of expected deviations from the expected geographic location of the computing device during the future temporal interval;

based on a determination that the expected geographic location and the range of expected deviations fail to include the geographic location of the computing device at the time of the requested digital interaction, perform operations that modify the position of the data element within the alert queue, the modified position indicating a second likelihood that the requested digital interaction represents the instance of actual fraudulent activity, and the second likelihood exceeding the first likelihood; and

transmitting, in real-time, to an additional computing device, a notification that includes the data element and information characterizing the modified position of the data element within the alert queue, the additional computing device performing operations that confirm the requested digital interaction represents the instance of actual fraudulent activity based on the data element and the information.

Assignments (1)

Continuity (2)

References Cited (29)